Privacy Notice

Last updated: 15 September 2026

This notice explains how [Company Legal Name] Ltd ("we", "us", "our"), trading as Car Control, collects and uses personal data when you use our website at [carcontrol.co.uk] (the "Site"), our free vehicle check preview, and our paid vehicle reports and report pack (together, the "Service"). We are the controller of the personal data described in this notice for the purposes of the UK GDPR and the Data Protection Act 2018, except where this notice says that another organisation, such as Stripe, acts as an independent controller.

1. Who we are

[Company Legal Name] Ltd is registered in [England and Wales] under company number [Company Number]. Our registered office is at [Registered Office Address]. Our VAT number, if we are registered for VAT, is [VAT Number, if registered]. Our ICO registration number is [ICO Registration Number].

Our data protection contact email is [privacy@carcontrol.co.uk]. Our general support email is [support@carcontrol.co.uk]. See our Contact page for full details.

2. What personal data we collect

We try to collect as little personal data as possible. You do not need to create an account to buy a report or pack, and we do not use advertising or analytics tracking cookies. If you do sign in or create an account, we do not use a password: see the account bullet below. We collect:

Registration numbers you search. When you look up a vehicle, we log the registration number entered, together with the date and time and your IP address.
Server and security logs. Our hosting infrastructure automatically records technical information such as IP address, browser type, pages requested, and timestamps, for security and reliability purposes.
Order records, if you buy a report or pack. When you buy a Basic report, a Premium report, or the 3 Premium reports pack, we keep a record of the registration you searched, the Stripe checkout session and payment reference, the tier or pack purchased, the amount paid, the date and time of your purchase, the timestamp of your consent to immediate delivery and acknowledgement of the loss of your cancellation right, and the access token for your report link.
Pack and credit records, if you buy the 3 Premium reports pack, or if we add a free credit. We keep a record of your pack link or code, how many credits remain on your account, which registrations you have redeemed a credit against, the date each credit was redeemed, and the consent given at each redemption. This includes a free Premium credit we add automatically where our commercial data supplier holds no historical records at all for a vehicle, as explained on our Cancellation and Refund Policy. This lets us honour your remaining credits and their 12-month expiry.
Your email address, if you buy a report or pack. We do not collect your email address ourselves at checkout. Stripe collects it from you as part of the payment process, so that it can send you a payment receipt, and passes it to us so that we can send you the confirmation and pack details described in section 5, create an account for that email address as described below, and deal with any refund or cancellation request.
Account data, if you sign in or an account is created for you. An account is created automatically for the email address used at checkout, and you can also sign in or create an account at any time without a password, using a one-time 6-digit code emailed to you, a one-time sign-in link emailed to you, or "Sign in with Google". If you use Google, we receive only your Google account email address, whether Google has verified it, and a Google account identifier, from Google as described in section 5. We hold your email address, your Google account identifier if you have used Google sign-in, the dates your account was created and last signed into, and your active sign-in sessions. If you delete your account, we remove this record, though we keep the order records described above for the periods set out in section 7.
Messages you send us. If you email us, for example at [support@carcontrol.co.uk] or [privacy@carcontrol.co.uk], we keep a record of your message, your email address, and our reply.

We do not ourselves collect or store your card details. We do not ask you to create a password, or provide your name, address or date of birth, to use the Service.

3. Vehicle registration numbers and personal data

A vehicle registration number is not, by itself, always personal data. However, the Information Commissioner's Office (ICO) takes the view that a registration number can become personal data where it can reasonably be linked, directly or indirectly, to an identifiable individual, for example because it is combined with other information such as the vehicle's make, colour and location, or because someone (including us or a third party) is able to connect the registration to its keeper.

Because a registration number you search could be linked to you personally, for example if it is your own vehicle, or could identify another individual, for example a seller's vehicle, we treat the logging of searched registration numbers, including registrations sent to DVSA, DVLA or CheckCarDetails Ltd and registrations redeemed against a pack credit, as processing of personal data and apply this notice to it, even where in a particular case the registration number cannot in fact be linked to an identifiable person.

4. Why we use your personal data and our lawful basis

What we use it for	Lawful basis
Running the Service: sending your registration number to DVSA, DVLA and, where used, CheckCarDetails Ltd, and showing you the results and our analysis	Legitimate interests: operating the free service you have asked to use. We only send the registration number itself to these sources, no other personal data about you.
Detecting and preventing abuse, for example automated scraping or excessive querying that could put our data access at risk	Legitimate interests: keeping the Service available, secure and within the terms of our data access
Maintaining and improving the Site, understanding usage patterns from logs	Legitimate interests: service improvement and security
Responding to your emails and support or data protection requests	Legitimate interests, and where relevant, compliance with our legal obligations, for example under data protection law
Taking payment for a report or pack through Stripe, generating and delivering reports, sending confirmation emails, tracking and honouring credits (including a free credit we add automatically where our data supplier has no records for a vehicle), and dealing with any refund or cancellation request	Performance of a contract with you
Creating and maintaining your account, letting you sign in by email code, email link or Google, and showing you your credits, open reports and past orders on the "My account" page	Performance of a contract with you, and, for the security of the sign-in itself, legitimate interests in keeping accounts secure
Keeping order and credit redemption records, including payment references and consent timestamps, for accounting, tax and dispute purposes	Legal obligation (accounting and tax record keeping), and legitimate interests (being able to show what was agreed and paid for if a dispute or chargeback arises)
Preventing and detecting payment fraud, chargebacks and abuse, including misuse of pack credits	Legitimate interests: protecting us and other customers from fraudulent transactions
Complying with our legal obligations, for example responding to a lawful request from a regulator or law enforcement body	Legal obligation

Where we rely on legitimate interests, we have considered whether our interest in providing and protecting the Service is overridden by your interests or fundamental rights and freedoms. Because we collect only a registration number, IP address and timestamp for the free preview, keep it for a short, defined period, do not use it for marketing or profiling, and do not share it other than as described below, we consider our processing to be proportionate and within your reasonable expectations when you choose to use a free vehicle lookup service. You have the right to object to this processing, as explained in section 9 below.

We do not use your personal data for any purpose other than those listed above. We do not sell your personal data, and we do not use it for advertising or profiling.

5. Who we share data with

We send the registration number you enter to DVSA and DVLA, and, where used, to CheckCarDetails Ltd, so that we can retrieve and show you the results, including the additional commercial vehicle history, valuation and specification data that CheckCarDetails Ltd provides for the Premium report and pack. We do not send them your IP address, email address or any other personal data. DVSA and DVLA act as independent controllers of the data they hold and provide to us; their own privacy notices apply to how they use that data. CheckCarDetails Ltd processes the registration numbers we send it to look up and return vehicle data to us; whether it acts as our processor or as an independent controller for this purpose depends on the terms of our agreement with it, which we will confirm and update this notice to reflect before launch.

Stripe. If you buy a report or pack, payment is handled by Stripe Payments UK Ltd ("Stripe") through Stripe Checkout, a page hosted by Stripe. You enter your card details directly with Stripe; we never see or store your full card details. For its role in processing your payment, verifying the transaction and preventing fraud, Stripe acts as an independent controller of your data, not as our processor: it decides how it uses the payment and card data you give it, in line with its own privacy notice. Stripe collects your email address to send you its own receipt, and passes your email address and order details back to us so that we can provide the confirmation, pack details and support described in this notice. You can read Stripe's privacy notice at [Stripe privacy notice link].

Google. If you choose to sign in using "Sign in with Google", Google LLC and Google Ireland Limited act as an independent controller of the sign-in data they hold about you, in line with Google's own privacy policy. We receive back from Google only your Google account email address, whether Google has verified it, and a Google account identifier: we do not receive your Google contacts or any other Google data, and Google sign-in is only ever used to let you into your account, not for any other purpose. If you do not use Google sign-in, no data is exchanged with Google.

Email provider. We use [Email Provider] to send the confirmation emails described above, including your pack link and credits remaining, your one-time sign-in codes and links, and to send you your access link if you need it resent. [Email Provider] processes this on our instructions as a processor.

We also use a hosting provider, [Hosting Provider, location], to run the Site and store logs. Our hosting provider processes data on our instructions as a processor and is contractually required to keep it secure.

We do not otherwise share your personal data with third parties, except where required by law, for example in response to a valid court order or a lawful request from a public authority, or where needed to establish, exercise or defend a legal claim, for example in response to a chargeback or payment dispute raised through Stripe or your card issuer.

6. International transfers

We host the Site with [Hosting Provider, location]. If our hosting provider, Stripe, CheckCarDetails Ltd, our email provider, Google, or any other processor or independent controller we use stores or accesses data outside the United Kingdom, we will only allow this, or rely on it, where the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Extension to the EU-US Data Privacy Framework, the UK addendum to the EU standard contractual clauses, or another safeguard recognised under UK data protection law. Google LLC participates in the UK Extension to the EU-US Data Privacy Framework for transfers of this kind; where that does not apply, transfers rely on the UK addendum to the EU standard contractual clauses. Stripe and major email providers are international businesses that may process data outside the UK; each maintains its own transfer safeguards, details of which can be found in their published privacy notices. If you would like further detail about a specific transfer, contact [privacy@carcontrol.co.uk].

7. How long we keep data

Searched registration numbers, with IP address and timestamp: retained for [30] days, then deleted or anonymised, unless we reasonably need to keep a specific record for longer to investigate suspected abuse or fraud, or to comply with a legal obligation.
Order records and pack credit redemption records (registration searched, Stripe payment reference, tier or pack purchased, amount paid, date, consent and acknowledgement timestamps, pack link or code, credits remaining, and access token): retained for 6 years from the end of the accounting period in which the purchase or redemption was made, in line with our HMRC and accounting record keeping obligations and to allow us to deal with disputes, chargebacks and refund or cancellation requests. This applies even if you later delete your account.
Account data (email address, Google account identifier if used, dates your account was created and last signed into, and active sign-in sessions): retained for as long as your account is open, and deleted when you delete your account from the account page, other than the order records described above, which we keep for 6 years as explained there.
Report snapshots: deleted after the 30-day access period for that report ends [confirm exact deletion process before launch].
Server and security logs: retained for a limited period necessary for security and reliability purposes, then deleted or anonymised.
Emails and support correspondence: retained for as long as reasonably necessary to deal with your query and for a reasonable period afterwards in case of follow up, then deleted.

8. Keeping your data secure

Access by our own staff to order and account data is restricted to named administrators, who must use two-factor authentication to sign in, and administrator sign-in and actions are logged. Administrator access uses a separate administrator session cookie, described in our Cookie Policy, and is used only by our staff, not by customers.

9. Your rights

Under the UK GDPR you have the right to:

be informed about how your personal data is used (this notice);
request access to the personal data we hold about you;
request that we correct inaccurate personal data;
request that we erase your personal data, in certain circumstances;
request that we restrict the processing of your personal data, in certain circumstances;
object to our processing of your personal data where we rely on legitimate interests, including the logging described in this notice;
request portability of personal data you have provided to us, in certain circumstances; and
not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not carry out this kind of automated decision making.

To exercise any of these rights, email [privacy@carcontrol.co.uk]. If you have an account, you can delete it yourself at any time from the account page, which removes your account record and signs you out everywhere, though we keep order records for 6 years as explained in section 7. For anything else, or if you do not have an account, please tell us the registration number, or your pack link or code, and the approximate date and time you searched or purchased, so we can locate the relevant record. We will respond within one month, as required by law, and may extend this by up to two further months for complex requests, in which case we will tell you why.

You also have the right to complain to the Information Commissioner's Office (ICO) if you think we have not handled your personal data properly. You can contact the ICO at ico.org.uk, or by telephone on 0303 123 1113. We would appreciate the chance to address your concern before you contact the ICO, so please contact us first at [privacy@carcontrol.co.uk] if you are able to.

10. Children

The Service is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [privacy@carcontrol.co.uk] and we will take appropriate steps to remove it.

11. Cookies and similar technologies

Details of the cookies and similar storage used on the Site, including the report and pack access tokens stored in local storage, the sign-in session cookie, the short-lived Google sign-in cookie, the administrator session cookie, and why no cookie consent banner is currently needed, are set out in our Cookie Policy.

12. Changes to this notice

We may update this notice from time to time, for example if we change how the Service works or if the law changes. We will update the "last updated" date at the top of this page when we do.